Register of Interests and Gifts & Hospitality City of York Council Internal Audit Report 2017/18

Business Unit: Corporate and Cross Cutting Responsible Officer: Director of Customer and Corporate Services Service Manager: Head of Human Resources Head of Business Support Services Date Issued: 5 September 2018 Status: Final Reference: 19100/004

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Reasonable Assurance | Summary and Overall Conclusions

Introduction

The council's Employee Code of Conduct requires that all employees declare any personal interests they consider could conflict with the interests of the council or adversely affect the performance of their duties. Such disclosure protects employees from accusations of impropriety. Declarations should be made in accordance with the Declaration of Officer Interests Policy.

Additionally, each directorate should hold a register (or registers) on which offers of gifts and hospitality should be recorded, along with details of rejection or acceptance and subsequent distribution as per the requirements of the Gifts and Hospitality Policy.

Objectives and Scope of the Audit

The purpose of this audit was to provide assurance to management that procedures and controls within the system ensure that:

- registers are kept and completed in accordance with policy and are easily accessible to staff
- declarations of interest are made by all relevant staff
- registers are reviewed regularly by appropriate officers

The audit covered staff declarations of interests and gifts and hospitality. Members' declarations were not included.

The previous audit, carried out in 2015-16, received a Limited Assurance opinion. This audit followed up the actions that were agreed to ensure that the issues and control weaknesses had been satisfactorily addressed.

Key Findings

The Declaration of Officer Interests and Gifts and Hospitality policies were revised in May 2016 and now provide clearer guidance on the council's expectations, stating how the responsibility for declaring interests and registering gifts or hospitality extends to all staff and specifying the authorisation and review requirements placed on line managers and chief officers (although some further clarification in respect of authorisation and review of Corporate Management Team gifts and hospitality registers would be beneficial). Both policies and their supporting documents are readily available via the council's intranet. Following the 2015/16 audit, the process for obtaining annual declarations was combined with the related party returns process coordinated by Corporate Finance such that there was a mechanism to obtain declarations from officers at grade 10 and above each year. The CIPFA Code of Practice on Local Authority Accounting requires that related party disclosures are made by key management personnel (chief officer level).

The council maintains a target of receiving 80% of declarations from grades 10 and 11 given that there is not a requirement for these declarations to be returned in order to prepare the accounts. Declarations were not received from over 50 officers across the four directorates in 2016/17. The council’s Declaration of Officer Interests policy states that declarations should be made for all officers at grade 10 and above and there was no evidence to confirm that the outstanding returns had been received prior to directors giving their annual approval. However, the issue is a lack of clarity in the Declaration of Officer Interests policy rather than a failure to adhere to the declaration procedure. Since the audit was completed a further change to the declarations process has been proposed and is being pursued. This is detailed in agreed actions 2.2 and 2.3.

All four directorates hold a register of gifts and hospitality in the council’s standard format and, based on the information available on the registers, there were no significant issues with the actions taken in respect of gifts or hospitality received. However, the way in which the registers are completed is such that the legitimacy and timeliness of authorisation cannot readily be determined. Furthermore, due to the quality of recordkeeping, it is not possible to confirm that the registers are routinely subject to annual review by directors. In addition, gifts or hospitality offered to Corporate Management Team are not authorised at point of entry onto the register nor are they reviewed on an annual basis.

**Overall Conclusions**

The arrangements for managing risk were satisfactory with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. Our overall opinion of the controls within the system at the time of the audit was that they provided Reasonable Assurance. 1 Gifts and Hospitality

| Issue/Control Weakness | Risk | |------------------------|------| | Inadequate or lack of evidence of authorisation and review of registers. | Lack of scrutiny or oversight may mean gifts are accepted inappropriately resulting in the integrity of the council or its officers being called into question. |

Findings

In 2016/17 council directorates received a total of 17 gifts with an approximate combined value of £1,820 and, as at January 2018, had received a further six gifts with a combined value of £100. In 2016/17 Corporate Management Team accepted 20 offers of hospitality and had accepted a further 25 offers as at January 2018. In all cases these were for dinners at conferences and networking events and while no values were quoted for any of the entries, they are unlikely to have amounted to a significant financial value.

For three of the council's four directorates, the name of the authorising officer is typed onto the gifts and hospitality register with no other supporting evidence available on the register to corroborate the legitimacy of the approval. The authorisations are also seldom dated so it is not always possible to establish if the register had been updated at the time the gift or hospitality was offered and thus if authorisation of the action taken was timely and in accordance with policy. Annual staff reminders of the requirements of the Gifts and Hospitality Policy have not been issued for the previous two years and due to the way in which evidence of director review is recorded on the directorate gifts and hospitality registers, it is not possible to confirm that these reviews have taken place.

Entries made in the Corporate Management Team registers of gifts and hospitality are not authorised at the point of entry. Whilst none of the entries appeared inappropriate, the fact that the registers are not subject to review on an annual basis means that there is potentially a lack of oversight over the acceptance of gifts and hospitality. Furthermore, while the Gifts and Hospitality policy addresses the authorisation and review requirements for directorate registers it does not in fact address these requirements for Corporate Management Team registers.

Agreed Action 1.1

The policy will be revised to include six monthly reminders of the requirements of the policy. The policy review will also introduce a change to process in the recording of gifts and hospitality in that where gifts or offers of hospitality are accepted email approval is attached to the register as evidence.

______________________________________________________________________

1 The total value for 2016/17 gifts and hospitality does not include seven entries for which no values were given. The total value for 2017/18 (as at January 2018) gifts and hospitality does not include four entries for which no values were given.

### Agreed Action 1.2

Directors will be reminded each year of the requirement to review the register annually and the Chief Executive will also be required to review entries in the directors’ registers on an annual basis.

| Priority | 3 | |----------|---| | Responsible Officer | Head of HR / Head of Business Support Services | | Timescale | December 2018 |

### Agreed Action 1.3

General awareness raising will also take place during the year through Buzz.

| Priority | 3 | |----------|---| | Responsible Officer | Head of HR / Head of Business Support Services | | Timescale | December 2018 | 2 Register of Interests

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The Declaration of Officer Interests policy lacks clarity in relation to the declaration procedure. | The corporate governance standards expected by the council are not achieved. |

Findings

As of 2015/16 the council has run a combined process for annual returns. Corporate Finance obtains declarations from staff at grade 10 and above as part of the related party disclosures process and then provides Executive Support with a spreadsheet consolidating these returns. In line with the policy, Corporate Finance requests declarations from officers below chief officer (i.e. director and assistant director) level even though this is not a requirement in order to produce the accounts. The CIPFA Code of Practice on Local Authority Accounting only requires, in respect of related party disclosures, that these are obtained from key management personnel, defined as:

“...all chief officers (or equivalent), elected members, chief executive of the authority and other persons having the authority and responsibility for planning, directing and controlling the activities of the authority, including the oversight of these activities.”

The Declaration of Officer Interests Policy, which sets out the council’s stance on conflicts of interests, states the following:

“Declarations should be made in the Register of Staff Interests...on an annual basis for all officers at Grade 10 and above as part of the ‘related parties’ statement of accounts process (Finance led)”

In practice, a 100% return rate is sought for staff at grade 12 but the council has set an 80% return rate target for grades 10 and 11. Once this target is met any outstanding returns are not chased further. Therefore, there is a minor discrepancy between the Declaration of Officer Interests policy, which reads that declarations should be made by all officers at grade 10 and above, and the current declaration procedure where this is not a requirement. The policy would benefit from review and clarification to ensure that it remains fit for purpose and meets the corporate governance standards that are acceptable to the council.

Another discrepancy between the policy and procedure is in the way in which the registers are distributed to directors for review. The declarations from staff in other directorates are only hidden and not removed from the directorate register and this means that the confidentiality requirements of the policy are not complied with.

Agreed Action 2.1

The Declaration of Officer Interests policy will be reviewed to ensure that it remains fit for

Priority 3 purpose and meets the corporate governance standards that are acceptable to the council.

| Responsible Officer | Head of HR / Head of Business Support Services | |---------------------|-----------------------------------------------| | Timescale | September 2018 |

**Agreed Action 2.2**

Twice a year, staff at grade 10 and above will be asked to submit their Declaration of Interests, including a nil response. The timing of the requests for declarations will be such that they allow sufficient time for the related party disclosures to be made in the accounts.

| Priority | 3 | |----------|---| | Responsible Officer | Head of HR / Head of Business Support Services | | Timescale | September 2018 |

**Agreed Action 2.3**

A central register will be maintained by Business Support which will then send this to DMTs to approve (Corporate Director responsibility) twice a year.

| Priority | 3 | |----------|---| | Responsible Officer | Head of HR / Head of Business Support Services | | Timescale | September 2018 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |--------------------|------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.